Resubmissions
15/01/2025, 22:47
250115-2qr9kszlbr1005/12/2024, 14:59
241205-scvywayrgz1017/12/2023, 23:15
231217-28y5vagccl1027/10/2023, 11:50
231027-nzmhssfg491014/10/2023, 04:05
231014-enwgwshf9710Analysis
- max time kernel
104s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20231023-en - resource tags
- submitted
27/10/2023, 11:50
General
- Target 6cf8bfba1b221effcb1eccec0c91fb0906d0b8996932167f654680cb3ac53aac.dll
- Size 12.1MB
- Sample231027-nzmhssfg49
- SHA256 6cf8bfba1b221effcb1eccec0c91fb0906d0b8996932167f654680cb3ac53aac
Malware Config
Signatures
- Blocklisted process makes network request 5 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6cf8bfba1b221effcb1eccec0c91fb0906d0b8996932167f654680cb3ac53aac.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6cf8bfba1b221effcb1eccec0c91fb0906d0b8996932167f654680cb3ac53aac.dll,#12⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension "exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 10523⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1540 -ip 15401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_y4hub5gd.ngq.ps1
memory/4148-23-0x000000007F370000-0x000000007F380000-memory.dmp
memory/4148-42-0x00000000072A0000-0x00000000072AE000-memory.dmp
memory/4148-3-0x0000000004F00000-0x0000000005528000-memory.dmp
memory/4148-4-0x0000000004E70000-0x0000000004E92000-memory.dmp
memory/4148-24-0x0000000006330000-0x0000000006362000-memory.dmp
memory/4148-6-0x0000000005740000-0x00000000057A6000-memory.dmp
memory/4148-0-0x0000000002450000-0x0000000002486000-memory.dmp
memory/4148-16-0x00000000057B0000-0x0000000005B04000-memory.dmp
memory/4148-17-0x0000000005D40000-0x0000000005D5E000-memory.dmp
memory/4148-18-0x0000000005DE0000-0x0000000005E2C000-memory.dmp
memory/4148-19-0x0000000072C50000-0x0000000073400000-memory.dmp
memory/4148-21-0x0000000000AA0000-0x0000000000AB0000-memory.dmp
memory/4148-2-0x0000000000AA0000-0x0000000000AB0000-memory.dmp
memory/4148-22-0x0000000000AA0000-0x0000000000AB0000-memory.dmp
memory/4148-5-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/4148-25-0x000000006F060000-0x000000006F0AC000-memory.dmp
memory/4148-35-0x00000000062D0000-0x00000000062EE000-memory.dmp
memory/4148-36-0x0000000006FE0000-0x0000000007083000-memory.dmp
memory/4148-37-0x0000000007710000-0x0000000007D8A000-memory.dmp
memory/4148-38-0x0000000006D90000-0x0000000006DAA000-memory.dmp
memory/4148-39-0x00000000070D0000-0x00000000070DA000-memory.dmp
memory/4148-40-0x00000000072C0000-0x0000000007356000-memory.dmp
memory/4148-41-0x0000000007250000-0x0000000007261000-memory.dmp
memory/4148-1-0x0000000072C50000-0x0000000073400000-memory.dmp
memory/4148-43-0x0000000007360000-0x0000000007374000-memory.dmp
memory/4148-44-0x00000000073A0000-0x00000000073BA000-memory.dmp
memory/4148-45-0x0000000007390000-0x0000000007398000-memory.dmp
memory/4148-48-0x0000000072C50000-0x0000000073400000-memory.dmp